{"cve":"CVE-2026-19256","enrichment":{"created":"2026-11-05T07:30:14.789288+00:00","updated":"2026-11-05T07:30:14.789293+00:00","vendors":[],"weaknesses":["CWE-307","CWE-200"]},"mitre":{"cpes":[],"created":"2026-11-05T06:00:23.724000+00:00","description":"The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/19xxx/CVE-2026-19256.json","references":["https://wpscan.com/vulnerability/576162c1-324f-4618-b167-c05e37f50c74/"],"title":"All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force","updated":"2026-11-05T06:00:23.724000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-11-05T06:17:08.240000+00:00","description":"The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-19256.json","references":["https://wpscan.com/vulnerability/576162c1-324f-4618-b167-c05e37f50c74/"],"title":null,"updated":"2026-11-05T06:17:08.240000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2026-11-05T06:15:00+00:00","data":[{"details":{"new":"The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.","old":null},"type":"description"},{"details":{"new":"All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force","old":null},"type":"title"},{"details":{"added":["https://wpscan.com/vulnerability/576162c1-324f-4618-b167-c05e37f50c74/"],"removed":[]},"type":"references"}],"id":"81740788-5786-4052-8dfc-38069570004d"},{"created":"2026-11-05T07:45:00+00:00","data":[{"details":{"added":["CWE-200","CWE-307"],"removed":[]},"type":"weaknesses"}],"id":"e6bc935b-db8f-419e-ac54-66bf24626122"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T06:00:23.724000+00:00","provider":"mitre"},"description":{"data":"The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://wpscan.com/vulnerability/576162c1-324f-4618-b167-c05e37f50c74/"],"providers":["mitre","nvd"]},"title":{"data":"All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force","provider":"mitre"},"updated":{"data":"2026-11-05T07:30:14.789293+00:00","provider":"enrichment"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":["CWE-200","CWE-307"],"providers":["enrichment"]}}}